Bedrock Ops Skill
Safely manage the RAG data pipeline: S3 uploads, Bedrock KB ingestion, session management.
Setup
First time per project
# 1. Generate aws-project.json (lists available profiles, generates config)
uv run python SKILLS_DIR/scripts/setup_project.py <profile-name> [s3-bucket]
# 2. Create aws-project.local.json with your TOTP secret
echo '{"totp_secret": "YOUR_BASE32_SECRET", "mfa_serial": "YOUR_MFA_ARN"}' > aws-project.local.json
Verify setup
# Check session and identity
uv run --with pyotp,boto3 python SKILLS_DIR/scripts/session.py ensure
Commands
All commands are handled by Claude interpreting the user's intent and routing to the appropriate script.
Identity & Session
| Intent |
Implementation |
/bedrock-ops setup |
Run uv run python SKILLS_DIR/scripts/setup_project.py to list profiles, then generate config |
/bedrock-ops verify |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/session.py check |
/bedrock-ops session |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/session.py ensure |
S3 Operations
| Intent |
Implementation |
/bedrock-ops s3 ls [path] |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 ls s3://<bucket>/<path> |
/bedrock-ops s3 sync <local> <s3> |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 sync <local> <s3> (dry-run first, add --execute for real) |
/bedrock-ops s3 force-upload <local> <s3> |
Use aws s3 cp --recursive instead of sync — required when only file content changed but byte count is the same (e.g. after adding chunk anchors). Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 cp <local> s3://<bucket>/ --recursive (dry-run first, add --execute for real) |
/bedrock-ops s3 upload <file> [s3path] |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 cp <file> s3://<bucket>/<path> |
/bedrock-ops s3 download <s3path> [local] |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 cp s3://<bucket>/<path> <local> |
Cost & Resources
| Intent |
Implementation |
/bedrock-ops cost |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py ce get-cost-and-usage --time-period Start=$(date -v1d +%Y-%m-%d),End=$(date +%Y-%m-%d) --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE |
/bedrock-ops resources ec2 |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py ec2 describe-instances --query 'Reservations[].Instances[].{Id:InstanceId,Type:InstanceType,State:State.Name,Name:Tags[?Key==\Name`].Value |
/bedrock-ops resources s3 |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 ls |
/bedrock-ops resources lambda |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py lambda list-functions --query 'Functions[].{Name:FunctionName,Runtime:Runtime,Memory:MemorySize}' |
Bedrock Knowledge Bases
| Intent |
Implementation |
/bedrock-ops kb list |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py bedrock-agent list-knowledge-bases |
/bedrock-ops kb sync <kb-id> |
Auto-detect data source ID, then run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py bedrock-agent start-ingestion-job --knowledge-base-id <kb-id> --data-source-id <ds-id> --execute |
/bedrock-ops kb status <kb-id> |
Poll ingestion job status. Run aws bedrock-agent list-ingestion-jobs --knowledge-base-id <kb-id> --data-source-id <ds-id> --profile personal-session --region ap-northeast-1 --query 'ingestionJobSummaries[0].{status:status,started:startedAt,updated:updatedAt,stats:statistics}' --output json. Repeat every 15 seconds until status is COMPLETE or FAILED. Print elapsed time. |
Arbitrary Command
| Intent |
Implementation |
/bedrock-ops exec <args> |
Run uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py <args> |
Safety Rules (ALWAYS enforced by aws_safe.py)
- Identity check: Before any write operation,
sts get-caller-identity must match account_id in aws-project.json. Abort on mismatch.
- Explicit profile: Every command uses
--profile from config. Never rely on env vars or default.
- Dry-run first: For s3 sync/cp/mv, always
--dryrun first. Show output. User must confirm with --execute.
- No silent deletes:
--delete and destructive operations blocked unless --i-understand-this-deletes is passed.
- Service blocklist: Respect
safety.denied_services in aws-project.json (default: iam, organizations).
- Confirmation banner: Before write ops, display profile, account ID, command, and mode (dry-run/live).
- Session auto-refresh: If session expired, auto-regenerate using TOTP from aws-project.local.json.
Config Files
aws-project.json (project root, committed) — profile, account_id, safety rules, defaultsaws-project.local.json (project root, gitignored) — totp_secret, mfa_serial, personal overrides
Path Variables
SKILLS_DIR = .claude/skills/bedrock-ops
1---2name: bedrock-ops3description: Bedrock KB + S3 data pipeline management with safety guardrails. S3 sync (with force-upload for content-only changes), KB ingestion status polling, cost monitoring. Enforces identity verification, dry-run, and confirmation for all write operations.4---5
6# Bedrock Ops Skill
7
8Safely manage the RAG data pipeline: S3 uploads, Bedrock KB ingestion, session management.
9
10## Setup
11
12### First time per project
13
14```bash
15# 1. Generate aws-project.json (lists available profiles, generates config)
16uv run python SKILLS_DIR/scripts/setup_project.py <profile-name> [s3-bucket]
17
18# 2. Create aws-project.local.json with your TOTP secret
19echo '{"totp_secret": "YOUR_BASE32_SECRET", "mfa_serial": "YOUR_MFA_ARN"}' > aws-project.local.json
20```
21
22### Verify setup
23
24```bash
25# Check session and identity
26uv run --with pyotp,boto3 python SKILLS_DIR/scripts/session.py ensure
27```
28
29## Commands
30
31All commands are handled by Claude interpreting the user's intent and routing to the appropriate script.
32
33### Identity & Session
34
35| Intent | Implementation |
36|--------|---------------|
37| `/bedrock-ops setup` | Run `uv run python SKILLS_DIR/scripts/setup_project.py` to list profiles, then generate config |
38| `/bedrock-ops verify` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/session.py check` |
39| `/bedrock-ops session` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/session.py ensure` |
40
41### S3 Operations
42
43| Intent | Implementation |
44|--------|---------------|
45| `/bedrock-ops s3 ls [path]` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 ls s3://<bucket>/<path>` |
46| `/bedrock-ops s3 sync <local> <s3>` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 sync <local> <s3>` (dry-run first, add `--execute` for real) |
47| `/bedrock-ops s3 force-upload <local> <s3>` | Use `aws s3 cp --recursive` instead of sync — **required when only file content changed but byte count is the same** (e.g. after adding chunk anchors). Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 cp <local> s3://<bucket>/ --recursive` (dry-run first, add `--execute` for real) |
48| `/bedrock-ops s3 upload <file> [s3path]` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 cp <file> s3://<bucket>/<path>` |
49| `/bedrock-ops s3 download <s3path> [local]` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 cp s3://<bucket>/<path> <local>` |
50
51### Cost & Resources
52
53| Intent | Implementation |
54|--------|---------------|
55| `/bedrock-ops cost` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py ce get-cost-and-usage --time-period Start=$(date -v1d +%Y-%m-%d),End=$(date +%Y-%m-%d) --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE` |
56| `/bedrock-ops resources ec2` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py ec2 describe-instances --query 'Reservations[].Instances[].{Id:InstanceId,Type:InstanceType,State:State.Name,Name:Tags[?Key==\`Name\`].Value|[0]}'` |
57| `/bedrock-ops resources s3` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py s3 ls` |
58| `/bedrock-ops resources lambda` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py lambda list-functions --query 'Functions[].{Name:FunctionName,Runtime:Runtime,Memory:MemorySize}'` |
59
60### Bedrock Knowledge Bases
61
62| Intent | Implementation |
63|--------|---------------|
64| `/bedrock-ops kb list` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py bedrock-agent list-knowledge-bases` |
65| `/bedrock-ops kb sync <kb-id>` | Auto-detect data source ID, then run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py bedrock-agent start-ingestion-job --knowledge-base-id <kb-id> --data-source-id <ds-id> --execute` |
66| `/bedrock-ops kb status <kb-id>` | Poll ingestion job status. Run `aws bedrock-agent list-ingestion-jobs --knowledge-base-id <kb-id> --data-source-id <ds-id> --profile personal-session --region ap-northeast-1 --query 'ingestionJobSummaries[0].{status:status,started:startedAt,updated:updatedAt,stats:statistics}' --output json`. Repeat every 15 seconds until status is `COMPLETE` or `FAILED`. Print elapsed time. |
67
68### Arbitrary Command
69
70| Intent | Implementation |
71|--------|---------------|
72| `/bedrock-ops exec <args>` | Run `uv run --with pyotp,boto3 python SKILLS_DIR/scripts/aws_safe.py <args>` |
73
74## Safety Rules (ALWAYS enforced by aws_safe.py)
75
761. **Identity check**: Before any write operation, `sts get-caller-identity` must match `account_id` in `aws-project.json`. Abort on mismatch.
772. **Explicit profile**: Every command uses `--profile` from config. Never rely on env vars or default.
783. **Dry-run first**: For s3 sync/cp/mv, always `--dryrun` first. Show output. User must confirm with `--execute`.
794. **No silent deletes**: `--delete` and destructive operations blocked unless `--i-understand-this-deletes` is passed.
805. **Service blocklist**: Respect `safety.denied_services` in aws-project.json (default: iam, organizations).
816. **Confirmation banner**: Before write ops, display profile, account ID, command, and mode (dry-run/live).
827. **Session auto-refresh**: If session expired, auto-regenerate using TOTP from aws-project.local.json.
83
84## Config Files
85
86- `aws-project.json` (project root, committed) — profile, account_id, safety rules, defaults
87- `aws-project.local.json` (project root, gitignored) — totp_secret, mfa_serial, personal overrides
88
89## Path Variables
90
91- `SKILLS_DIR` = `.claude/skills/bedrock-ops`
majiayu000